Find the right cybersecurity service for your business

The first conversation is a scoping conversation, and it is short. Three questions do most of the work: what could you not be without for a day, what is already in place, and what is forcing the timing — a customer, an auditor, an insurer, or something that has already happened.

The first thing that carries a fee is a fixed-scope assessment: a questionnaire and an external scan, a gap analysis, and a report with a prioritised plan. It is quoted as a named scope for a named fee, and our quotes stay valid for thirty days, so you can take one into a budget meeting without it expiring on you.

If you want something in hand before you call, the self-assessment on this site is twelve questions across eight areas and takes about five minutes.

One at a time is the normal shape, and that is structural rather than a concession. Each service is its own service description and its own order: supplier monitoring, brand protection, dark web monitoring, executive protection and managed detection are four or five separate signatures, not a bundle with a discount on it.

Two of them have an upgrade path written into the product rather than into a sales conversation — high-volume supplier monitoring escalates into directed remediation when you decide the findings are worth acting on, without re-buying anything.

The one thing we will not blur is build versus run. An implementation ends at go-live with documentation and handover; continuous operation is a separate contract on purpose, so that you can change your mind about the second without unpicking the first.

No, and the delivery model assumes they are there.

Monitoring runs inside your own tenant: you keep the licences, you host the infrastructure, the data stays in your environment, and our analysts work through delegated access that you grant and can revoke. On implementation work the split is written down before anything starts — we build inside the platform being deployed, and changes inside your other production systems are executed by whoever runs them today, with our instructions alongside.

Supplier work goes further in the other direction: we deal with your vendors directly, which is where most of the hours in that service actually go, and which is the part your IT provider was never going to do anyway.

An incident retainer is set up in advance with pre-authorisation for both your internal IT and your third-party providers — precisely so nobody is negotiating access at three in the morning.

One assessment with a named scope. Concretely, any of these is a complete piece of work on its own.

A point-in-time cyber risk report on a single supplier or an acquisition target, delivered in days. A one-off security and compliance assessment ending in a report and a prioritised plan. Or one infrastructure element reviewed properly — a firewall rule base, a wireless estate, a server hardening baseline — with findings, the evidence behind them, and a management summary.

None of those obliges you to anything afterwards, and an assessment is a reasonable way to find out how we work before committing to a term. We would rather you did that than signed twelve months on the strength of a meeting.

Weeks for anything that watches from outside, because there is nothing to install.

The external services start from a questionnaire and a kick-off, with detection live from day one and a fourteen-day tuning period whose only job is to stop it being noisy. Supplier onboarding runs to a five-business-day commitment per third party, and the platform takes on the order of ten thousand suppliers a month — so the length of your vendor list is not the constraint people assume it is. An executive baseline report lands within a month of the investigation starting.

A SIEM deployment is about three weeks: a week to plan, a week to build and connect log sources, a week to test, tune and hand over.

Quarters are for programmes — a transformation, a carve-out, a regulatory readiness run. The difference matters, and we will tell you which one you are actually buying rather than letting the word "project" cover both.

Yes, and what changes is depth rather than coverage.

We scope to your window instead of to a standard timetable, and we say in advance what will not fit inside it — including what gets covered at interview depth rather than at evidence depth, and what the report will mark as unverified. That last part is information the deadline owner needs, not an excuse.

Where something genuinely cannot be finished inside the window, it becomes a decision rather than a drift: started immediately with a compensating control and evidence of progress on file, or moved deliberately into a longer plan with your approval on the record.

For deadlines that arrive from outside — a customer questionnaire, a procurement decision, a deal — there are report formats built for days rather than weeks.

The pattern in our own reference work starts outside the perimeter, because it needs nothing installed and no agreement with your IT provider: supplier risk monitoring and brand protection, usually together, then executive protection for the handful of people whose exposure is personal rather than corporate. One client took that combination on to a group-wide rollout across eleven countries.

What gets added second is usually ownership rather than another tool — a security leadership engagement that turns findings into a plan somebody is accountable for. Detection and response tends to arrive third, once there is a decision-maker to agree a response profile with.

The other direction is just as common: a bounded advisory piece first, then continuous leadership when the decisions keep arriving whether or not anyone is there to make them.

Less than you fear on the monitoring services, more than you hope on the technical ones. Specifically:

For the external monitoring services: one questionnaire naming your brands, domains, applications, social accounts and the people to protect; a kick-off; then validating the first batch of findings so the tuning is against your reality rather than a generic profile. After that you either approve takedowns case by case or give a standing instruction, at which point your involvement is reading reports.

For an advisory or leadership engagement: one to two hours of onboarding, up to half a day for the assessment session if you want it run jointly rather than by questionnaire, a review meeting every two to four weeks, and a management review twice a year.

For a SIEM deployment, the heaviest: your team executes the changes inside your own systems — enabling logging, opening collection paths, the cloud integrations — and a few steps need someone with global administrator rights. We flag those in advance rather than discovering them mid-project.

We say so and tell you who does. The boundary is drawn in writing before anything starts rather than discovered later, and there are two kinds of it worth knowing about.

Boundary by design: on hardening and firewall work the deliverable is the assessment and the proposal, your specialists execute, and we join the remediation only if you ask us to. On advisory work we do not touch your production systems at all.

Boundary by contract, which is the one that surprises people: remediation and the products it obliges you to buy sit outside an advisory fee, as do penetration testing and an auditor’s own fee; a managed service covers the systems named in the order, and a log source needing an unusually long onboarding becomes separate work; an incident retainer covers the legal entity named on it and not automatically its subsidiaries or its parent.

We would rather show you those lines than let you assume past them and find out during an incident.